翻訳待ち：Agent Security Is a Systems Problem: What 247 Papers Say About Secure AI Agents

AI サービスが一時的に利用できないため、復旧後に翻訳を補完します。

LLM Agent Security: Runtime and Control Planes | TrueFoundry --> --> --> Meet TrueForge: The open-source, vendor-neutral agent harness. 50% lower cost. Explore Now→ PricingLive Demo Book Demo 2k Book Demo Sign Up Login Get instant access to a live TrueFoundry environment. Deploy models, route LLM traffic, and explore the full platform — your sandbox is ready in seconds, no credit card required. Agent Security Is a Systems Problem: From Prompt Injection to Runtime Control Built for Speed: ~10ms Latency, Even Under Load Blazingly fast way to build, track and deploy your models! Handles 350+ RPS on just 1 vCPU — no tuning needed Production-ready with full enterprise support Get Started with Truefoundry NowTalk to the Expert A major 2026 survey of LLM-agent security reaches a conclusion enterprise teams should take seriously: once a model can use tools, retain state, and act on behalf of someone else, security is no longer mainly a prompt-filtering problem. It becomes a systems problem spanning information flow, delegated authority, and persistent state. Security Framework Notes and Key Takeaways Source and independence note. This article is grounded in Yuchen Ling, Shengcheng Yu, Zhenyu Chen, and Chunrong Fang, Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation (arXiv:2606.10749, revised August 23, 2026), which synthesizes 247 papers. The mapping from the survey's security framework to TrueForge and TrueFoundry products is TrueFoundry editorial analysis; the paper does not evaluate or endorse TrueFoundry. The infrastructure thesis: secure agents need more than model-level safety. The runtime should make trust boundaries and state transitions explicit; shared gateways should enforce identity, access, policy, credentials, budgets, guardrails, and evidence at model, tool, and agent boundaries; and systems of record should remain authoritative for business state and side effects. Key Takeaways Prompt injection is only one part of the problem. The survey finds tool-mediated control-flow hijacking remains prominent, while persistent-state corruption and multi-agent propagation are increasingly important. Agent security has three coupled dimensions. Information enters the agent, authority lets it act, and persistent state lets an attack outlive the original interaction. Controls need to compose across layers. A sandbox, guardrail, approval workflow, or gateway is useful, but none establishes security for the entire agent by itself. TrueForge maps to the runtime boundary. It provides the execution loop, context management, tools, sandboxing, approvals, sessions, and events for agents built on it. TrueFoundry Gateways map to shared control planes. AI Gateway governs routed model calls; MCP Gateway governs routed tool/data access; Agent Registry establishes identity, ownership, and access for registered agents, while broader Agent Gateway controls can add quotas, budgets, and traces for routed agent traffic. Provenance-aware state remains an application responsibility. Persisting events is not the same as proving the integrity or trustworthiness of every piece of memory or business state. 1. Why Agent Security Is Different From LLM Safety The survey starts from a simple architectural fact: an LLM agent does more than generate text. It may plan, invoke tools, browse, execute code, update state, and coordinate with other agents. Those capabilities turn model outputs into inputs to software control flow. That changes the failure mode. A malicious instruction hidden in a web page can influence a later tool call. A poisoned tool result can become context for another decision. A compromised memory entry can survive the original session. A delegated credential can turn a bad plan into a real side effect. In a multi-agent system, the same contaminated information may propagate beyond the agent that first encountered it. The survey therefore frames agent security around three interacting properties: Figure 1. TrueFoundry editorial synthesis of the survey's systems model. Risk compounds when untrusted information intersects with delegated authority and persistent state. The useful implication is that secure-agent architecture should not ask only, “Did we block the malicious prompt?” It should also ask: what could that content influence, what authority could the resulting trajectory exercise, and what state could the trajectory leave behind? 2. The Attack Surface Runs Through the Whole Agent Lifecycle Ling and coauthors use a lifecycle-based, systems-oriented framework rather than a flat list of attack names. Operationally, it is useful to separate the core action path—input, planning, decision, tool execution, and output—from cross-cutting surfaces such as memory, monitoring, and multi-agent coordination, because those surfaces can influence or observe multiple stages of the run. Figure 2. The core lifecycle is Input → Planning → Decision → Tool Execution → Output. Memory, monitoring, and coordination are cross-cutting surfaces that can influence or observe multiple stages rather than simply occurring afterward. This lifecycle perspective also explains why defenses can be “weakly compositional,” as the survey puts it. A content filter may block one class of malicious text but do nothing about over-privileged credentials. A sandbox may contain code execution but not prevent an authorized API call. An approval gate may stop one side effect but not a poisoned memory write. A trace may make an incident observable without preventing it. Security therefore emerges from the composition of boundaries, privileges, state controls, and evidence. 3. Mapping the Survey to TrueForge and TrueFoundry The cleanest product mapping is not “TrueFoundry solves agent security.” It is to ask which part of the survey's systems model each layer can realistically govern. Security Requirements Table Security requirement from the survey Natural control surface TrueForge / TrueFoundry role Important boundary Explicit trust boundaries Runtime + model/tool/agent interfaces TrueForge separates the loop from its sandbox and external services; AI/MCP/Agent Gateway surfaces can centralize routed access Traffic or state that bypasses those boundaries is not governed by them Principled privilege control Identity, access, credentials, approvals AI Gateway access policy; MCP server/tool authorization and downstream credentials; Agent Registry access; TrueForge approval checkpoints Approval does not replace standing authorization Provenance-aware state Sessions, events, application metadata, systems of record TrueForge persists sessions and emits runtime events; Gateways add request/tool/agent traces Persisted telemetry is not automatically a cryptographic or semantic proof that memory is trustworthy Containment Execution environment TrueForge sandbox-as-tool isolates code/files/shell operations and keeps model/MCP credentials in the harness A sandbox does not constrain an externally authorized tool unless policy does Runtime mediation Model/tool boundaries AI/MCP guardrails, access controls, approvals, budgets, and rate limits on routed traffic No single guardrail detects every attack family Deployment-realistic evidence Runtime and gateway observability TrueForge events plus TrueFoundry model/tool/agent metrics and traces Downstream system logs remain necessary to prove authoritative side effects 4. Information Flow: Treat External Context as Untrusted Data—and Preserve Provenance One of the survey's most important reframings is that prompt injection is an information-flow problem. The dangerous instruction may come from a user, but it may just as easily come from a retrieved document, a web page, a tool response, another agent, or a persistent memory entry. That means the architecture should distinguish where information came from from what the model infers it means, and preserve provenance where that distinction matters downstream. TrueForge: make the runtime boundary explicit TrueForge is an open-source agent harness that provides the model/tool loop, context management, sandboxing, approvals, sessions, and events. Its sandbox-as-tool design is particularly relevant to the survey's trust-boundary argument: the agent loop and model/MCP credentials remain in the harness, while code, files, and shell execution happen in an isolated environment provisioned when needed. This is a useful separation of concerns. The sandbox can be treated as a lower-trust execution surface without also becoming the store of agent credentials or conversational authority. MCP Gateway: inspect and govern the tool boundary TrueFoundry MCP Gateway adds a shared boundary between agents and enterprise tools. Current documentation describes centralized registry and discovery, OAuth/token management, server/tool access control, pre- and post-tool guardrails, approval workflows, and request/response auditability for traffic routed through the Gateway. That matters because a tool result is not merely data. It can become new context that influences subsequent planning. Post-tool inspection therefore has a different role from pre-tool authorization: one controls whether the tool may run; the other can inspect what information comes back into the agent loop. 5. Delegated Authority: Least Privilege: Keep Agent Authority No Broader Than the Task Requires The survey's second axis is delegated authority. Agent systems are risky not only because models can be manipulated, but because a manipulated model may be holding real authority on behalf of a user, team, application, or service. This is where least privilege needs to become an architectural property rather than a prompt instruction. Product Component Definitions AI Gateway Centralizes model access, API keys, rate limits, budgets, routing, guardrails, and observability for model traffic routed through it. MCP Gateway Centralizes MCP server/tool discovery, user authentication, tool authorization, outbound credentials, guardrails, approvals, and audit for routed tool calls. Agent Registry / Gateway Provides registry-backed identity, ownership, collaborator-based access control, and routing for registered agents. Broader Agent Gateway controls can add quotas, budgets, and centralized tracing for routed agent traffic. The dedicated On-Behalf-Of workflow remains documented as Coming Soon, so this article does not treat full OBO exchange semantics as generally available today. TrueForge Can pause a run at selected human checkpoints and preserve the session state needed to continue after approval or denial. The most important design principle is that these controls answer different questions. Authorization says whether an actor may use a capability. Guardrails constrain requests or results. HITL inserts human judgment at a selected moment. Budget and rate limits constrain economic and operational authority. None is a substitute for the others. 6. Persistent State: A Security Surface That Outlives the Prompt The survey highlights persistent-state corruption as an emerging concern. That matters because agents increasingly outlive a single prompt or HTTP request. They preserve conversations, files, memory, summaries, tool results, plans, and sometimes learned preferences across long workflows. TrueForge's SDK makes this runtime state legible through an explicit hierarchy of Agent → Session → Turn → Event → Delta. Sessions can survive reconnects and restarts, turns chain within a session, and events expose what the runtime is doing—including MCP initialization, model messages, tool responses, approval requirements, and turn completion. That is valuable for security because it gives operators an inspectable history. But observability should not be confused with provenance guarantees. State-Security Rule Note State-security rule: if a memory or state element can influence a future action, recor [truncated for AI cost control]